ExternalVendorCode/go-attestation
1
0
Fork 0
mirror of https://github.com/google/go-attestation.git synced 2024-12-19 13:08:04 +00:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity
182 Commits 3 Branches 15 Tags 4.6 MiB
63c5188962
Commit Graph

115 Commits

Author SHA1 Message Date
Eric Chiang
e688ff6d7f attest: rename MintAIK and MintOptions to NewAIK and AIKConfig 
This helps the godoc read better and is more inline with Go's naming
scheme. No functional changes made, just naming.
 2019-08-28 09:25:14 -07:00
Tom D
fefdb7d336
Add quote example, add note to Activation.Generate() about use of subtle to prevent timing attacks (#84) 2019-08-27 16:15:48 -07:00
Tom D
d2afca77f5
Implement example for AIK creation and activation. (#83) 2019-08-27 12:40:58 -07:00
Eric Chiang
78755e7a91 attest: remove Log statements from tests (#81) 
Tests generally shouldn't print anything unless they fail.
 2019-08-21 10:28:55 -07:00
Eric Chiang
9b6caf1273 attest: use provided randomness source when generating challenges (#80) 
Currently the activation challenge lets a caller supply a source of
randomness other than crypto/rand, but it's not used in some places.
Plumb the source through the call chain.
 2019-08-21 10:28:19 -07:00
Eric Chiang
bfcbe8f1e2 attest: re-work EK API (#79) 
This PR adds:
* Renames 'PlatformEK' to 'EK'
* More consistant support of EKs without certificates
* Removes HTTP GET to Intel EK certificate service
* Always populates EK.Public
 2019-08-21 10:26:55 -07:00
Eric Chiang
cd07b32602 attest: add testdata for crypto agile event (#82) 
Test data copied from
https://github.com/mwiseman32/Attestation-annotation
 2019-08-21 10:00:18 -07:00
Tom D
6e2e8693ad
75: Make PCRs() take the digest algorithm (#77) 2019-08-20 11:52:12 -07:00
Eric Chiang
262599a8df attest: add event log parsing logic 
This PR adds event log parsing logic. It's main goal is to require
validation at the same time as parsing, so structured events are always
verified against a quote. This new API replaces the exisitng "verifier"
package.

It's not a goal of this PR to parse the event data. This will be a
follow up, but since different users might want to parse different
events based on the OS, this API lets users of this package implement
custom event data parsing if they absolutely need to.
 2019-08-19 23:50:31 -07:00
Tom D
a1822903b4
Add dump mode to attest-tool. (#70) 2019-08-13 14:53:38 -07:00
Tom D
3d58c70c6a
Add firmware version to TPMInfo for TPM 2.0 devices. (#67) 2019-08-08 11:31:09 +10:00
Eric Chiang
3a523cf51f
Merge pull request #62 from ericchiang/aik_pub 
attest: move public key parsing server side
 2019-08-07 08:05:08 -07:00
Tom D
55b3a2dc04
Update vendors list (#57) 2019-08-06 16:47:13 -07:00
Eric Chiang
7d7676beda attest: move public key parsing server side 
Event log parsing requires knowning both the public key and signing
parameters. Symmantically, this information should be from an attested
public key blob, not additional data passed by the client.

Introduce a new method for parsing an AIK's public key blob, returning
a new AIKPublic struct.
 2019-08-06 11:09:20 -07:00
Eric Chiang
59036c6bcb
Merge pull request #60 from ericchiang/key_purpose 
attest: remove unused KeyPurpose exported type
 2019-08-06 09:48:50 -07:00
Eric Chiang
8e83383df9 attest: improve documentation of ActivateCredential (#61) 2019-08-05 17:39:57 -07:00
Eric Chiang
9020140437 attest-tool: aik.json shouldn't be executable (#65) 2019-08-05 17:39:25 -07:00
Eric Chiang
833a7e119f attest: remove unused KeyPurpose exported type 
Was going through the godoc and it's not clear that this is ever used.
To clean up the API, remove KeyPurpose for now. This could probably be
an internal validation anyway, right?
 2019-07-30 07:42:42 -07:00
Tom D
f3f08037f8
Make SRK/AIK templates consistent with go-tpm-tools (#58) 2019-07-26 13:16:47 -07:00
Tom D
8f4f17e679
Implement credential activation API (#56) 2019-07-23 15:22:53 -07:00
Eric Chiang
2464131d7c Add a Public() method to the AIK that returns a public key (#55) 
We plan to identify AIKs based on their public key. The raw blob should
be available via the AttestationParameters, but we hope that users will
only use that struct for generating challenges.

Because this parses the public key on AIK creation and loading, this PR
should have existing coverage.
 2019-07-22 09:18:51 -07:00
Tom D
5f05ce5cec
Fix attest-tool (#54) 
* Fix attest-tool
 2019-07-19 14:07:02 -07:00
Tom D
90e37eacce
Refactor part 1: Refactor logic for keys into structs for each TPM/platform invariant. (#53) 
* Refactor serialized keys into own structure, in preparation for making Key an interface.

* Refactor key logic into separate structures for each platform/TPMversion invariant.

* Implement review feedback
 2019-07-19 13:05:18 -07:00
Tom D'Netto
da446762c0 Implement fetch from ekcert server if no EKs are found, and the TPM is from intel. 2019-07-17 15:15:29 -07:00
Tom D
0f6a187a1c
Fix sig mismatch in AIK certification (#50) 2019-07-12 10:30:30 -07:00
Tom D
372fcf25d0
Try reading the EKCert from PCP_EKNVCERT (#46) 2019-06-25 15:19:12 -07:00
Tom D
113729bb8b
Add indication to EKCert error string for when NVRAM value was unwrapped (#45) 2019-06-20 10:58:41 -07:00
Tom D
7585e609b4
Remove main.go (#44) 2019-06-18 09:11:08 -07:00
Tom D
ba4708dfc8
Rename attest-tool to match rules for BUILD targets (#43) 
* Implement example cmd-line binary.

* Add ability to generate random nonce

* Rename attest-tool to match rules for BUILD files
 2019-06-18 09:09:39 -07:00
Tom D
04f428d103
Implement example cmd-line binary. (#42) 
* Implement example cmd-line binary.

* Add ability to generate random nonce
 2019-06-17 15:50:05 -07:00
Tom D
1eb89bd0b8
Use certificate-transparency asn1 parser (#41) 2019-06-12 11:14:43 -07:00
Tom D
7c3baced09
Fix typos. (#40) 2019-06-12 10:15:42 -07:00
Tom D
8afa43fc13
Better error messages for parseCert() (#39) 2019-06-12 10:11:18 -07:00
Tom D
8ac2846c80
Attempt fix for EKCert parsing errors when falling back to NVRAM (#38) 
* Fix parsing errors for EKCert when falling back to NVRAM
 2019-06-11 10:52:49 -07:00
Tom D
7f17046a60
Fix broken build on windows. (#36) 
* Attempt to read the EK from NVRAM if the system cert store cannot provide it.

* Fix broken build on windows.
 2019-06-06 13:15:55 -07:00
Tom D
3dc8a7d841
Attempt to read the EK from NVRAM if the system cert store cannot provide it. (#35) 2019-06-06 13:11:40 -07:00
Tom D
1611c5ab72
Fix quote generation on windows TPM 1.2 devices (#34) 2019-05-20 12:34:17 -07:00
Tom D
5b7e00554a
Implement new credential activation scheme for windows (#33) 
* Implement new credential activation scheme for windows
 2019-05-16 15:51:01 -07:00
Tom D
70c839779d
Moar error codes (#32) 2019-05-15 12:57:08 -07:00
Tom D
dbbcfcc4b8
Fix conversion to more specific windows error messages. (#31) 2019-05-15 12:27:19 -07:00
Tom D
20b39443ef
Fix ActivateCredential for TPM 1.2 on windows (#30) 2019-05-15 10:36:54 -07:00
Tom D
7b5f790215
Fix broken DLL MustFindProc. (#29) 2019-05-14 14:44:33 -07:00
Tom D
55ce06b8f2
Decode windows TPM/PCP errors to more specific descriptions. (#28) 2019-05-14 11:42:44 -07:00
Tom D
ac78180218
Implement key deletion on Windows (#27) 
* Implement key deletion on Windows

* Dont forget 2nd parameter in call to NCryptDeleteKey
 2019-05-13 14:41:55 -07:00
Tom D
2ff4e84fcb
Check the state of the TPM before opening it on windows (#26) 
* Check the state of the TPM before opening it on windows
 2019-05-13 14:13:16 -07:00
Tom D
2da0098d9d
Switch over to trying the PCP provider for TPM 1.2, to mitigate missing ownerauth. (#25) 
* Implement decoding for TPM 1.2 PCP AIK properties

* Switch all TPM 1.2 methods that rely on ownerAuth to use the PCP API.
 2019-05-03 13:27:48 -07:00
Tom D
8e4a5ce762
Ignore slightly malformed EKs so attestation can continue. (#24) 2019-05-02 13:43:50 -07:00
Tom D
4ee1aa81b1
Add more logging to MintAIK() (#22) 2019-04-30 08:47:44 -07:00
Denis Karch
125f464487 Fix typo (had nonce and pcr data backwards) 2019-04-25 10:15:54 -07:00
Denis Karch
1643d281b5 Fix call to NewQuoteInfo 2019-04-24 14:26:48 -07:00
DenisKarch
97d50a1edc Use go-tpm NewQuoteInfo (#18) 2019-04-24 13:55:44 -07:00
DenisKarch
0d33e753a1 Have Quote return TPM_QUOTE_INFO (#17) 2019-04-24 13:18:36 -07:00
DenisKarch
3829815b47 Extract and return PCR digest for Quote on TPM1.2 (#16) 
go-tspi and go-tpm return different values for "quote".
In both cases we want the PCR digest so we extract it from the data
returned.
 2019-04-24 11:19:18 -07:00
DenisKarch
4342561e0f Fix quote12 (previously only getting PCR0) (#15) 2019-04-23 18:28:51 -07:00
Tom D'Netto
24ccdf576a Improve error messages on windows 2019-04-11 10:57:45 -07:00
DenisKarch
b128fd7448 Move AIK to Storage hierarchy (#10) 
Moving AIK to storage hierarchy so that the key blob can be saved and
loaded instead of recreating the aik each time.
 2019-04-10 11:03:02 -07:00
DenisKarch
b15816bdc8 Fix to imports (update.go could not map properly) (#11) 2019-04-09 11:33:23 -07:00
Denis Karch
dc8d5cb824 Added TPM1.2 support for Windows 2019-04-09 10:48:16 -07:00
Tom D
0a5a5f0656
Refactor tests: remove build tags, de-dupe, use flags to control test runs from now on (#8) 2019-04-05 14:49:36 -07:00
Tom D
063d2bdf7e
Implement full coverage for TPM 1.2 tests. (#7) 
* Generate and store a fake EK certificate in TPM 1.2 test setup.

* Fix run of gen_ekcert.go

* Write out NVRAM cert header when generating ek cert

* Remove build flag gating tpm12 tests.
 2019-04-04 15:33:00 -07:00
Tom D
790d3ba149
Script setup of fake filesystem objects for tpm12 tests, fix build of tpm12 tests. (#5) 2019-04-03 12:19:25 -07:00
Tom
f3ea38462e Make package a Go module, add build tags for tests that need special system setup 2019-04-01 11:06:07 -07:00
Tom
7e37dd3701 go fmt 2019-03-28 14:00:07 -07:00
Tom
ca33c04742 Validate secret in attest_tpm12_test, fix godoc 2019-03-28 13:29:24 -07:00
Tom
21c2bfd1dc Initial commit. 2019-03-28 13:21:16 -07:00